Heathrow based British Airways, the BBC and Boots have all been targeted.
The fraudsters thought to be Russian made the threat in broken English on the dark web.
The Clop group gained access to the firms’ data bases by hacking a third-party payroll software.